Company locked by ransomware. Hacker message says 'I'll delete data if you don't pay'. Will going to the police cause other issues? Is there insurance covering 'ransom payment'?
Is paying ransom illegal? Will we face sanctions? Some companies say 'paid but didn't get data back' while others say 'paid and recovered'. Is it really down to luck?
Are there other hackers who want to find you? If I pay, does my payment make me a target for other hackers?
Paying ransom is legally and ethically controversial. There is no explicit ban criminalizing ransom payment in Turkey, but there are US/EU restrictions (counter-terrorism financing laws).
Cyber insurance: many policies cover 'ransom payment' costs, some don't. Check your policy. Important: whether the insurance (if any) negotiates with the hacker matters; paying without consultation might void coverage.
Result: paying ransom mostly fails (30-50% data recovery rate). There are legal, financial, and ethical risks.
nobody will tell you to pay, but if you have insurance, insurance pays insurance negotiates with hacker. tbh dont pay with your own money
There are many companies that paid and didnt get data back! Research it, 10 companies in Turkey filed lawsuits for this in 2024.
Most of the hacker's messages are just scare tactics. They said they'd delete the data, but they're actually selling the stolen data. It hasn't been deleted.
Statistically: 35% of ransomware victims paid the hacker, 50% of those got their data back, 50% didn't.
Present this clearly to management: 'If we pay — 50% chance we don't get the data back + insurance coverage voided + risk of further attacks. If we restore from backup — we lose 2 weeks of data but the system is back up within a week.'
Let me speak from the other side; I'm on the supplier side. Taking notes for two weeks yields better results than a six-month estimate.
Having backups accessible on the same network and with the same identity makes them part of the target. If I were you, I'd go this route.
there's a trap here, let me mention it then honestly if you don't write this down from the start it leads to arguments later.
just leaving this note it might be useful.
The opposite happened to me, that's why I'm writing. When you try to change everything at once, nothing settles.
Most incidents start with a leaked password, not a vulnerability. If you have questions, write them; I'll answer as best I can.
Let me speak from the other side; I'm on the supplier side. The biggest time-waster for us was not knowing who had the final say.
People defend habits, not processes. Resistance comes from there. Just leaving this note, it might be useful.
Following. The biggest time-waster for us was not knowing who had the final say.
Trying to do this alone is the most expensive way. This is my opinion, I'm not claiming it's absolute truth.
Let me write how its done in practice. like any unwritten clause becomes a point of disagreement later, as both sides remember it differently.
Solutions that work at a small scale collapse when you grow; I learned this late. tbh proven by experience.
We need to take it step by step. Having backups accessible on the same network and with the same identity makes them part of the target.
That's all, sorry if I went on too long.
theres a trap here let me mention it. mistakes made on the should i pay ransom side are usually reversible but expensive.
There's a common mistake people make when doing this. People defend habits, not processes. Resistance comes from there.
Hope this helps.
Great work. Payment information changes are never verified through the channel they came from.
Proven by experience.
I've been down this road, let me tell you. The biggest time-waster for us was not knowing who had the final say.
I agree. I mean security isn't absolute; it's about making attacks not worth the effort.
If you get three different answers on a topic, the question was asked wrong. Of course, it varies if your situation is different.